Inventoros 2.4.0

This release adds a one-command Linux installation path and hardens role management, warehouse stock movements, installation, account emails, GraphQL and webhook delivery. It includes every change since 2.3.0.

Installation and deployment

• The Linux installer provisions Docker when needed, generates secrets, starts the app, PostgreSQL, worker and scheduler, and waits for healthy services. It supports automatic HTTPS with a domain, an existing reverse proxy, and upgrades to a chosen release. Finish organization and administrator setup in the web installer. The script is attached as install.sh to this release.
• New Coolify and cloud-init templates provide additional deployment options.
• The web installer displays the correct PHP requirement and AGPL license in every supported language.
• LICENSE now contains the unmodified AGPL-3.0 text so GitHub can detect it; attribution and additional notices are retained in NOTICE.

See Linux installation and cloud deployment. (#333, #334)

Security fixes

• Development demo seeders are excluded from production Docker images and cPanel packages. Both demo entry points also refuse execution in production, even when forced, before creating accounts or marking installation complete.
• Database errors no longer reopen the public installation wizard. Unverifiable installation state returns HTTP 503; existing accounts keep setup closed if the installed database setting is lost. Successful new installations record INVENTOROS_INSTALLED=true outside the database.
• Staff and customer portal reset links and invitations use the configured APP_URL rather than an incoming request's hostname. Signed portal links include the configured origin in their signatures.
• Order creation, edits, reservation consumption and restocking enforce the caller's warehouse assignments through the shared services used by the web, REST, GraphQL and MCP surfaces.
• Tenant administrators cannot edit shared system roles. Delegated role managers can only manage permissions they hold, including grants from permission sets. Foreign permission sets cannot be attached, and role member lists no longer expose other organizations' users.
• GraphQL list limits cannot become unbounded through negative values. Object collection fields and eager loads are capped at 100 records, array batching is disabled, and nested collection cardinality is checked against a separate 50,000-node response budget before execution. Existing depth and field complexity limits remain in force.
• Webhook delivery enforces a 1 MiB limit on decoded response data during the transfer, including compressed and chunked responses. Delivery diagnostics retain at most 5,000 bytes of response body.

These fixes are documented in the security audit. (#336)

Changes for operators and integrations

• Create organization-owned custom roles to customize permissions; shared system roles are read-only. Review saved role definitions and permission-set attachments on existing installations for earlier unauthorized changes.
• Orders do not yet retain their original source bins, and serials/batches have no warehouse location of their own. Restricted staff must ask unrestricted staff to handle reversals or tracked stock movements whose warehouse ownership cannot be established safely.
• GraphQL clients should send one operation per request and use REST endpoints or exports for collections larger than 100 records.
• Set APP_URL to the application's public URL, including an installation subdirectory when applicable. Preserve INVENTOROS_INSTALLED=true when it has been written by completed setup.

Dependency alert reconciliation

The 58 GitHub Dependabot alerts inspected during this release referred to older versions: 43 concern dependencies already patched in the lockfile, and 15 concern packages removed from the tree. No committed dependency falls inside those reported vulnerable ranges. npm and Composer audits, including development dependencies, report no known vulnerabilities.

GitHub's dependency graph was disabled when inspected, leaving its inventory stale. Repository administrators should enable Dependency graph to reconcile the alerts. No alerts were dismissed to clear the count. The per-alert evidence records the ranges and locked versions checked.

Upgrade

There are no new database migrations since 2.3.0. Requirements remain PHP 8.4.1 or newer, MySQL 8.0+, PostgreSQL 13+, or SQLite for development. Back up the database, .env, APP_KEY, uploads and installed plugins before upgrading.

For Docker, pull the 2.4.0 image and recreate the app, worker and scheduler with the existing configuration and volumes. The Linux installer also accepts sudo bash install.sh --version 2.4.0. Source and cPanel installations can use their normal update process. Restart long-lived queue workers and clear/rebuild application caches after updating. Run the normal migration command even though this release adds none.

The separately distributed plugins retain their own release versions. Publishing this core release does not update a running installation automatically.